nerdexam
GIAC

GCIH · Question #444

How does a worm utilize the Warhol/Flash technique?

The correct answer is C. Large numbers of potentially vulnerable hosts are identified first and then exploited in groups,. The Warhol/Flash worm technique pre-scans the internet to build a hit-list of vulnerable hosts, then exploits them in coordinated groups to achieve near-instantaneous global propagation.

Malware Analysis & Advanced Persistent Threats

Question

How does a worm utilize the Warhol/Flash technique?

Options

  • AFlash movies are used to infect clients unknowingly and send links to everyone in the client's
  • BPrescanning is omitted so the worm can spread directly to every system in a block of IP
  • CLarge numbers of potentially vulnerable hosts are identified first and then exploited in groups,
  • DThe technique is meant to enable a worm to specifically evade all anti-virus and intrusion

How the community answered

(28 responses)
  • B
    4% (1)
  • C
    93% (26)
  • D
    4% (1)

Why each option

The Warhol/Flash worm technique pre-scans the internet to build a hit-list of vulnerable hosts, then exploits them in coordinated groups to achieve near-instantaneous global propagation.

AFlash movies are used to infect clients unknowingly and send links to everyone in the client's

Using malicious Flash media to infect clients and spread via social links describes a drive-by download or social engineering vector, not the Warhol/Flash worm's network propagation mechanism.

BPrescanning is omitted so the worm can spread directly to every system in a block of IP

Skipping prescanning and targeting every IP in a block describes a sequential exhaustive scan strategy, which is the opposite of the Warhol technique's pre-identification approach.

CLarge numbers of potentially vulnerable hosts are identified first and then exploited in groups,Correct

The Warhol/Flash technique begins with a prescan phase that identifies large numbers of vulnerable hosts before active spreading starts, producing a hit-list distributed to each newly infected machine. By targeting pre-identified vulnerable systems in groups rather than scanning randomly, the worm collapses its propagation time to minutes instead of hours. This coordinated group-exploitation from a pre-built target list is the defining characteristic of the technique.

DThe technique is meant to enable a worm to specifically evade all anti-virus and intrusion

Evading antivirus and intrusion detection systems describes polymorphic or obfuscation techniques used for stealth, which are unrelated to the Warhol/Flash worm's rapid propagation strategy.

Concept tested: Warhol/Flash worm hit-list pre-scanning propagation technique

Source: https://www.cs.columbia.edu/~smb/papers/flash-worm.pdf

Topics

#worm propagation#Warhol technique#Flash worm#prescan targeting

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice